abstract.tex

\begin{abstract}
  \emph{Proof-of-burn} has been used as a mechanism to destroy cryptocurrency in a
  verifiable manner. Despite its well known use, the mechanism has not been
  previously formally studied as a primitive. In this paper, we put forth the
  first cryptographic definition of what a proof-of-burn protocol is.
  It consists of two functions: First, a function
  which generates a cryptocurrency address. When a user sends money to this address,
  the money is irrevocably destroyed. Second, a verification
  function which checks that an address is really unspendable.
  We propose the following properties for burn protocols. \emph{Unspendability},
  which mandates that an address which verifies correctly as a burn address cannot be used for
  spending; \emph{binding}, which allows associating metadata with a particular burn;
  and \emph{uncensorability}, which mandates that a burn address is indistinguishable
  from a regular cryptocurrency address. Our definition captures all previously
  known proof-of-burn protocols.
  Next, we design a novel construction for burning which is simple
  and flexible, making it compatible with all existing popular cryptocurrencies.
  We prove our scheme is secure in the Random Oracle model.
  We explore the application of destroying
  value in a legacy cryptocurrency to bootstrap a new one.
  The user burns coins in the source blockchain
  and subsequently creates a proof-of-burn, a
  short string proving that the burn took place, which she then submits to
  the destination blockchain to be rewarded with a corresponding amount.
  The user can use
  a standard wallet to conduct the burn without
  requiring specialized software, making our scheme user friendly.
  We propose burn verification mechanisms with different security
  guarantees, noting that the target blockchain miners do not necessarily
  need to monitor the source blockchain. Finally, we implement the verification of Bitcoin burns
  as an Ethereum smart contract and experimentally measure that the gas costs needed for
  verification are as low as standard Bitcoin transaction fees, illustrating
  that our scheme is practical.
\end{abstract}